DFIR Engagement Manager

About UsAt SentinelOne, we’re redefining cybersecurity by pushing the limits of what’s possible—leveraging AI-powered, data-driven innovation to stay ahead of tomorrow’s threats.From building industry-leading products to cultivating an exceptional company culture, our core values guide everything we do. We’re looking for passionate individuals who thrive in collaborative environments and are eager to drive impact. If you’re excited about solving complex challenges in bold, innovative ways, we’d love to connect with you.About the role:SentinelOne’s Vigilance DFIR team conducts digital forensic investigations and threat hunting operations for global clients. Our team provides multiple levels of proactive and reactive services to our clients to include incident readiness assessments, table-top exercises, purple-team activities, full-breach investigation, malware analysis, and hunting operations. The selected candidate will be an experienced investigator and endpoint-based hunter with superior technical and customer services skills. What are we looking for?SentinelOne’s DFIR team conducts digital forensics investigations, incident response, and breach readiness engagements for global clients. Our team provides comprehensive proactive and reactive services, including incident readiness assessments, tabletop exercises, purple-team activities, full-breach investigations, malware analysis, and threat-hunting operations. This role will support the reactive DFIR services, managing the overall success of cyber incident investigations. In this role, you will work with our global team of DFIR analysts and serve as the point of contact with customers throughout the entirety of an investigation. The ideal candidate will be an experienced leader with technical expertise and exceptional client management skills.What will you do?Lead business development activities including scoping, requirements gathering, and contract developmentCollaborate with account teams and internal and external legal counsel to ensure service agreements and statements of work are in placeHandle high-stakes client interactions involving legal counsel or executive stakeholdersOversee active DFIR investigations, ensuring exceptional quality and timeliness of deliverablesEstablish and maintain clear communication channels with all stakeholdersManage DFIR investigation objectives, timelines, resource allocationCoordinate cross-functional teams including internal resources and external vendorsHandle escalations and resolve technical or operational challengesEnsure proper evidence handling and documentation throughout investigationsMaintain oversight of case documentation and artifact archivalEnsure adherence to standard operating procedures and best practicesLead post-engagement reviews and process improvement initiativesConduct technical analysis including endpoint forensics, log analysis, and threat-hunting when requiredMaintain flexibility with schedule and participate in weekend and holiday on-call scheduleAdopt and follow our core values amongst the team:Trust – We earn our client’s trust via technical expertise and a customer-first mindset.Accountability – Every team member contributes to our group success via diligently fulfilling their assigned duties.Collaboration —The DFIR team works closely with our threat intelligence, research, MDR, and product teams to ensure the success of every investigation.Relentlessness – We will leave no stone unturned to provide outstanding service and fulfill our client's needs.Ingenuity – If no tool or process exists to enable our investigations and hunts, then we will create one. There is always a way to improve existing methodologies.Community – The DFIR team supports each other as we grow and improve ourselves and our service.What skills and knowledge should you bring?5+ years of hands-on consulting experience in digital forensics and incident responseProven track record of managing complex incident response engagementsExpert-level experience with industry-standard forensic tools and methodologiesStrong understanding of and experience with EDR/XDR platforms and security technologiesExperience conducting malware analysis and memory forensics preferredDemonstrated experience in endpoint-based threat-hunting and compromise assessmentsExperience working with cyber threat intelligence platforms and processesExcellence in client communication and relationship managementExperience working with legal teams and insurance carriersStrong project management and team leadership skillsIndustry certifications (GCFE, GCFA, CFCE, EnCE, or similar) preferredActive participation in the security community through speaking engagements or publications preferredEvident self-starter with intellectual curiosity and the ability to adapt to changeWhy us?You will be joining a cutting-edge company, where you will tackle extraordinary challenges and work with the very best in the industry.Medical, Vision, Dental, 401(k), Commuter, Health and Dependent FSAUnlimited PTOIndustry leading gender-neutral parental leavePaid Company HolidaysPaid Sick TimeEmployee stock purchase programDisability and life insuranceEmployee assistance programGym membership reimbursementCell phone reimbursementNumerous company-sponsored events including regular happy hours and team building eventsThis U.S. role has a base pay range that will vary based on the location of the candidate. For some locations, a different pay range may apply. If so, this range will be provided to you during the recruiting process. You can also reach out to the recruiter with any questions.Base Salary Range$128,800—$160,000 USDSentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.SentinelOne participates in the E-Verify Program for all U.S. based roles. Originally posted on Himalayas

Apply Now